Log in Start free

EC-CUBE CO.,LTD.

Products

ProductCVEsExploitedLatest
EC-CUBE7–Jul 1, 2021
EC-CUBE 4 series5–Jul 30, 2024
EC-CUBE 2 series3–Aug 17, 2023
EC-CUBE 3 series and EC-CUBE 4 series2–Sep 27, 2022
EC-CUBE 3 series1–Nov 7, 2023
EC-CUBE 4.1 series1–Mar 5, 2026
EC-CUBE 4.2 series1–Mar 5, 2026
EC-CUBE 4.3 series1–Mar 5, 2026
EC-CUBE 4 series, EC-CUBE 3 series, and EC-CUBE 2 series1–Mar 5, 2023
EC-CUBE Business form output plugin (for EC-CUBE 3.0 series)1–Jun 22, 2021
EC-CUBE Category contents plugin (for EC-CUBE 3.0 series)1–Jun 22, 2021
EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series)1–Jun 22, 2021
EC-CUBE plugin 'Mail Magazine Management Plugin'1–Feb 24, 2022
EC-CUBE Web API Plugin1–Jul 30, 2024
EC-CUBE Web API Plugin (4.2 series)1–Jul 30, 2024
AmazonPay Plugin (4.0 series)1–Oct 14, 2026
Product Image Bulk Upload Plugin1–Sep 27, 2022
AmazonPay V2 Plugin (4.0/4.1 series)1–Oct 14, 2026
AmazonPay V2 Plugin (4.2/4.3 series)1–Oct 14, 2026
AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition)1–Oct 14, 2026

Exploited and recent CVEs

  • CVE-2026-103671 Medium 4.7 External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during th 0.2%
  • CVE-2026-103671 Medium 4.7 External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during th 0.2%
  • CVE-2026-103671 Medium 4.7 External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during th 0.2%
  • CVE-2026-103671 Medium 4.7 External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during th 0.2%
  • CVE-2026-30777 Medium 4.9 EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-fac 0.4%
  • CVE-2026-30777 Medium 4.9 EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-fac 0.4%
  • CVE-2026-30777 Medium 4.9 EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-fac 0.4%
  • CVE-2024-41924 High 7.2 Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may instal 0.3%
  • CVE-2024-41141 Medium 6.1 Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the OAuth Manageme 0.3%
  • CVE-2024-41141 Medium 6.1 Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the OAuth Manageme 0.3%
  • CVE-2023-46845 Unrated EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template 1.6%
  • CVE-2023-46845 Unrated EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template 1.6%
  • CVE-2023-40281 Unrated EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be e 0.4%
  • CVE-2023-22838 Unrated Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to 0.5%
  • CVE-2023-25077 Unrated Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitra 0.6%
  • CVE-2023-22438 Medium 5.4 Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p5), 0.7%
  • CVE-2022-40199 Low 2.7 Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privileg 1.2%
  • CVE-2022-38975 Medium 5.4 DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visi 0.7%
  • CVE-2022-37346 Critical 9.8 EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticate 1.2%
  • CVE-2022-25355 Unrated EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an 1.2%
  • CVE-2022-21179 Unrated Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remot 0.5%
  • CVE-2021-20842 Unrated Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially cra 0.6%
  • CVE-2021-20841 Unrated Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vecto 1.3%
  • CVE-2021-20778 Unrated Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors. 2.1%
  • CVE-2021-20751 Unrated Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially c 1.1%
  • CVE-2021-20750 Unrated Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by l 1.6%
  • CVE-2021-20744 Unrated Cross-site scripting vulnerability in EC-CUBE Category contents plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary script by leading an adm 0.8%
  • CVE-2021-20743 Unrated Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote attacker to inject an arbitrary script by lea 0.8%
  • CVE-2021-20742 Unrated Cross-site scripting vulnerability in EC-CUBE Business form output plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remote attacker to inject an arbitrary script via unspecifie 0.8%
  • CVE-2021-20717 Unrated Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE 2.3%